Responsible Disclosure Policy
In u-blox, the safety and security of our customers and users has always been a top priority. We are dedicated to improving our products continuously, focusing on changing market needs, technologic breakthrough, as well as evolving threat surface and new attack vectors. This Responsible Disclosure Policy is in place to identify new vulnerabilities and security issues in the relevant hardware, software or services provided by u-blox (“u-blox Products”) and to address them in a timely manner.
You can use this platform to report a vulnerability/security issue in any u‑blox Product, excluding end-of-life u‑blox products/services. In addition, u-blox is running an in-invite only bug-bounty program for certain u-blox services, that is operated in partnership with BugCrowd, for which you can apply (u-blox Bug Bounty Program on Bugcrowd).
Reporting a vulnerability in a good faith and by academical/private research is possible through our Responsible Disclosure Policy and is not going to be penalized. Targeted, malicious or persistent attacks, however, are strictly forbidden and will be reported to the relevant authorities in accordance with the relevant laws.
How to report
If you are an existing u-blox customer, you can submit a vulnerability/security issue report creating a support ticket in u-blox support portal.
In case you participate in the bug bounty program, please report your findings through Bugcrowd platform. In other cases, please contact us at firstname.lastname@example.org.
When reporting a security issue through email, do not send us any issue information in the initial message. Instead, send us the following information:
- Your contact details
- Preferred form of secure communication (e.g. PGP or S/MIME)
PGP public key and fingerprint: 359F 2E00 85CF 57DF 45B5 3970 B106 63C8 757F 1A21
Reporting the issue
After we have established the secure communication, please send us the following information to be able to address the issue:
- u-blox Product(s) affected, including version numbers;
- Vulnerability/security issue type, e.g. spoofing, tampering, remote code execution, information disclosure, denial of service, elevation of privilege;
- When and how did you learn about the vulnerability/security issue?
- Steps to reproduce the vulnerability/security issue including technical details;
- Supporting evidence, e.g. logs, screenshots, pictures, exploit code.
u-blox will assess each submission received. After your message, the following actions will be undertaken:
- The vulnerability/security issue will be prioritized analyzing the potential impact and exposure;
- We will confirm to you that we have received your report by an assigned security representative;
- We might request additional information from you as needed to investigate and resolve the issue;
- According to the nature of the vulnerability/security issue, we will fix and notify you, our customers and/or regulatory authorities, or take other actions as necessary.
To prevent exploitation of reported vulnerabilities/security issues before workarounds or fixes are available, we kindly ask you to refrain from disclosing the vulnerability/security issue until u-blox allows you to do so.
To recognize your contributions aside from payouts through the invite-only bug bounty program, we may, upon your authorization, thank you through an entry in the Acknowledgements section below. Please also note that as to your contribution made the terms and conditions for the u-blox website apply, and u-blox will thus be able to use any information provided in any commercial context.
We would like to thank all individuals and companies who have reported security issues in u-blox infrastructure or Products.
|Ronak Nahar||Aishwarya Kendle||Ali Razzaq||Mohammed Adam|
|Usama Abid||Avi Chakravarti||Badal Sardhara||Merbin Russel|
We continuously monitor and investigate reported security issues. In this section, we publish confirmed security vulnerabilities related to u-blox Products.
|Vulnerability ||Affected Product(s)||Recommendations |
Frame Aggregation vulnerability (FRAG)
Please refer to the information note. A new firmware is now available for a some of the affected products. u-blox teams are working on the further releases.
|Spectra coexistence vulnerability||
|Please refer to the information note. A new firmware is now available that patches the issue. |
|CVE-2019-16336, CVE-2019-17519, CVE-2019-17517, CVE-2019-17518, CVE-2019-17520, CVE-2019-19195, CVE-2019-19196, CVE-2019-17061, CVE-2019-17060, CVE-2019-19192, CVE-2019-19193, CVE-2019-19194 (Sweyntooth)||
Please refer to the information note. A new firmware is now available that patches the issue.
Fault injection vulnerability in nRF52 chips
|Please refer to the design considerations and product recommendations in the information note.|
|CVE-2019-15126 (Kr00k)||JODY-W1 series||Please refer to the information note. A new firmware is now available that patches the issue. |
Please refer to the product documentation available here:
u-connect Express Application Note Appendix A
EMMY-W1 Release Notes
JODY-W1 Release Notes
Bluethooth Pairing mode confusion
|All Bluetooth products||Please follow the recommendations from BT-SIG as mentioned below (LE, BR/EDR)|